Wicked Evolutions
WordPress Core · Universal Storage

The plugins on your site are already operable.

WordPress was built around a small set of universal storage structures that almost every plugin uses to file its data. The Abilities suite operates those structures directly — so most of the plugins you already run on WordPress become AI-operable without those plugins doing anything.

WordPress's universal storage is the surface. The Abilities suite operates that surface. Plugin coverage is a consequence — not a count.

What
Reach without integration.
A single set of core operations that reaches the data + meta + categorization + comments + settings layers of every plugin built on WordPress core.
Why
Because plugins write into shared storage.
When a plugin uses register_post_type, register_taxonomy, or post meta, its data lives in WordPress's own tables — addressable through one uniform interface.
How
The abilities are core-shaped, not plugin-shaped.
Every read and write goes through native WordPress APIs. The plugin's own hooks fire automatically — exactly as if the action came from wp-admin.
Brings
Whole-site operations, in one chain.
An AI agent can build a course, set its SEO meta in three languages, assign it to a category, and link it to a product — without switching tools between plugins.

01 / The shared storage

Five universal cabinets every plugin writes into.

WordPress organizes everything around five shared storage structures. The Abilities suite holds a key to all five — that is the entire mechanism.

01
Things
Every entity on the site — pages, posts, products, courses, lessons, custom anything.
wp_posts
02
Labels
Every category, tag, or grouping — product categories, course tracks, languages, brands.
wp_terms · wp_term_relationships
03
Notes on things
Every additional detail attached to an entity — price, SKU, SEO copy, course duration, language assignment.
wp_postmeta
04
Comments
Every comment, review, rating, or moderation note — including spam-score audit history.
wp_comments · wp_commentmeta
05
Settings
Every plugin's configuration — caches, CDNs, cookie banners, SEO globals, security policies.
wp_options

When a plugin needs to store data in WordPress, it almost always uses one of these. So the Abilities suite doesn't operate plugins. It operates the storage that plugins write into. Whatever a plugin has filed becomes addressable.


02 / Path one

Plugins that file their own things in the cabinet.

The obvious path. A plugin registers a custom post type — a product, a course, an event — and that entity lands in the same shared storage the editor and the REST API already understand. Full create, read, update, delete is available the moment the plugin is active.

WooCommerce
Files products in the things cabinet — list, create, edit, delete operate on them directly. Validated end-to-end against a live store.
post_type=product
LifterLMS
Files courses, lessons, quizzes, certificates, memberships — nineteen folders in the things cabinet, all operable through the same interface.
post_type=course · lesson · …
The Events Calendar
Files events, venues, organizers in the things cabinet. Eight hundred thousand active sites, all reachable.
post_type=tribe_events · …
Custom CPTs
Site builders register their own — testimonials, FAQs, recipes, jobs, listings, portfolios. Same surface, no extra work.
post_type=*

What the operator gets: build, audit, edit, and delete entities programmatically across every CPT-based plugin on the site — through one uniform set of operations.


03 / Path two

Plugins that file their data onto other plugins' things.

The surprising path. Some plugins don't have entities of their own — they attach data to other plugins' entities, or sit in the labels, comments, or settings cabinets. They are reachable for the same reason: shared storage.

Yoast SEO
Adds SEO settings on top of every page, post, course, product — anything that lives in the things cabinet.
notes · _yoast_wpseo_*
Rank Math
Same idea, different keys — coexists with Yoast on the same entities without conflict. Both readable, both writable.
notes · rank_math_*
Polylang
Adds language assignment on top of every entity and groups translations together — through four special label types in the labels cabinet.
labels · language · translations
Akismet
Adds spam scores and audit history on top of every comment — readable per-comment for moderation and quality work.
comments + notes
LiteSpeed · bunny.net · Cookie consent
No CPTs, no meta — just configuration. They write to the settings cabinet, which is reachable like the others.
settings · wp_options

No Yoast integration. No Polylang integration. No Rank Math integration. One set of operations for the cabinets — and those operations see everything in them.


04 / The compositional cross-multiplier

Five plugins, one entity, one chain of operations.

This is the consequence that turns the bridge from useful to structural. A single entity in WordPress can carry the data of many plugins simultaneously — and all of it is reachable through one read or one write.

Entity
A LifterLMS course
post_type=course · id=61
LifterLMS
Course duration, drip schedule, prerequisites
_llms_length
_llms_prereq
Yoast SEO
Meta title, meta description, OG image
_yoast_wpseo_title
_yoast_wpseo_metadesc
Rank Math
Independent SEO meta on the same course
rank_math_title
rank_math_description
Polylang
Language assignment, translation group
language · translations
LifterLMS taxonomies
Course category, tag, track, difficulty
course_cat · course_tag · course_track
Read all of it with one call. Edit any of it with one call. Five plugins' worth of data, on one course, through one set of operations.
That is what changes the AI-agent posture. The agent doesn't say "let me switch to the Yoast tool, then to Polylang, then to LifterLMS." It says "write SEO copy for this course in three languages and assign it to a category" — and that is one chain of operations through the cabinets.

05 / Live evidence

A WooCommerce product, end-to-end, without a WooCommerce integration.

Validated 2026-05-09 against a live WordPress site running WooCommerce. Sixteen calls. No plugin-specific abilities anywhere in the chain.

Site · abilitiesforai.io
WooCommerce · fresh install
Bridge · abilities-mcp 1.6.1
16 calls · 1 product · full lifecycle
0 woo functions called by us
01
content-create post_type=product title="Bridge Test"
id 50
02
content-get id=50
full record
03
content-list post_type=product
total 1
04
taxonomies-get-content-terms post_id=50
7 taxonomies
05
blocks-parse post_id=50
2 blocks
06
meta-update-post-meta _regular_price=29.99
written
07
meta-update-post-meta _sku · _stock_status · _manage_stock
written
08
content-update id=50 title="Updated via MCP"
success
09
taxonomies-assign-to-content product_cat terms=[16]
success
10
read-back · all writes confirmed stuck
verified
11
content-delete id=50 force=true
clean state

WooCommerce's own hooks fired throughout — exactly as they would for an action taken in wp-admin. The plugin saw a normal WordPress write and reacted normally. We never imported a WooCommerce class.


06 / The honest boundary

Where the bridge ends — and where dedicated work begins.

The same rule that makes the bridge broad makes its limit clear. Data in WordPress core's universal storage is reachable. Data in a plugin's private tables is not — until either the vendor adopts the WordPress Abilities API, or a dedicated suite is built.

Reachable through universal storage
Anything filed into WordPress's five shared cabinets.
  • Things · post types of any kind
  • Labels · taxonomies, including private ones
  • Notes · all post and term meta
  • Comments · including reviews and audit history
  • Settings · all wp_options entries
Validated against five newly-installed plugins on 2026-05-09 — Yoast, Rank Math, LifterLMS, Polylang, Akismet — plus WooCommerce. Cumulative install footprint: tens of millions of sites.
Out of scope for the bridge
Data plugins keep in their own private tables.
  • WooCommerce HPOS orders, sessions, payment tokens
  • FluentCRM contacts, FluentBooking appointments
  • LifterLMS student progress and quiz attempts
  • Webhook logs, tax rates, shipping zones
  • Anything in custom database tables
Two principled paths: the vendor adopts the WordPress Abilities API and exposes their private surface — or a dedicated suite is built. Abilities for Fluent is the worked example.

07 / The other half — runtime authorization

Reachable does not mean permitted. You decide what's exercised.

The bridge describes what is structurally addressable. A complementary architecture decides what is actually exercised at runtime. Four independent layers — and a call succeeds only when all four allow it.

Layer 01
WordPress capability
The OAuth user's role decides what they can do in WordPress in the first place. Editor, admin, custom — your existing role policy holds.
Native WP role check
Layer 02
OAuth scope
The token scope you grant on consent. Narrow by default — read and write, no delete. Broaden by reauthorizing.
Operator-controlled
Layer 03
Module permission
A per-module read/write/delete switch you set in the Permissions UI. Knowledge can be readable but not writable. Content writable but not deletable.
Operator-controlled
Layer 04
Per-ability gate
A publish-to-MCP flag on every individual ability — set by the author at registration, overridable by you in the Permissions UI.
Operator-controlled

The bridge is the upper bound on what's possible. The four layers are your cap on what's permitted. Together they are what's possible in principle × what's permitted in practice.


08 / What the surface actually looks like

Reach is multiplicative, not additive.

A representative WordPress site already running multiple plugins. Numbers from the live validation site, not invented.

Entity types
41
Distinct post types registered — WooCommerce, LifterLMS, WordPress core templates and fonts and blocks, custom CPTs.
Meta layers
6
LifterLMS fields, Yoast keys, Rank Math keys, WooCommerce keys, Polylang assignments, WordPress core meta — all coexisting on the same entities.
Reach
246
Distinct entity-meta combinations — all addressable through one operation shape. A third dimension of taxonomies multiplies again.

This is what makes the bridge structurally different from the industry default of one MCP per plugin. Instead of N integrations, the surface is N × M — and an AI agent walks all of it through the same operations.


09 / Where this fits

The Trinity carries the bridge to your AI client.

The bridge effect is what Abilities for AI contributes to the Trinity — a core-shaped operations registry that reaches everything WordPress files in shared storage. The MCP Adapter exposes that registry over HTTP. The Abilities MCP connects it to your client of choice — Claude, Cursor, Cline, anything that speaks MCP.

For surfaces the bridge cannot reach — Fluent's CRM and forms and community and cart — there is Abilities for Fluent: the dedicated suite that mirrors the Trinity's posture for plugins that keep their data in private tables.